If you want to run only discovery NSE scripts, which flag would you use?

• A. Use --script discovery to run only discovery NSE scripts.
• B. Use -sC to run safe default scripts.
• C. Use --script-args to specify categories.
• D. Use --script all.

Answer: (A)

You control which NSE scripts run by using the --script option, and it can take a category name to limit execution to that group. To run only discovery NSE scripts, specify the discovery category: --script discovery. This tells Nmap to load and execute only the scripts labeled as discovery, giving you focused information gathering.

The other options don’t achieve this: -sC runs the safe/default set of scripts, not just discovery. --script-args is for passing arguments to scripts, not selecting which scripts to run. --script all would attempt to run every available NSE script, not just those in the discovery category.